Velero

Kubernetes backup, restore, and migration tool. Velero saves cluster resource state (Deployments, Services, ConfigMaps, PVCs) and optionally PVC data to S3-compatible object storage. It supports recurring backup schedules, TTL-based expiration, and namespace-scoped or cluster-wide backup policies.

Key Features

• Cluster-scoped backup — saves Kubernetes resources and optionally PVC data to S3
• Kopia filesystem backup — uploaderType: kopia (modern replacement for Restic)
• Scheduled backups — Schedule resources rendered directly from chart values
• TTL-based expiration — backups expire automatically (default 7 days)
• Node-agent DaemonSet — optional filesystem backup for PVC data inclusion
• S3-compatible storage — validated with the AWS plugin for MinIO and AWS S3
• Restore-only mode — lock a cluster to restores only (useful for DR environments)
• Prometheus metrics — metrics Service and optional ServiceMonitor enabled by default

Installation

Velero requires cluster-wide permissions and is typically deployed in a dedicated namespace:

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install velero helmforge/velero -n velero --create-namespace -f values.yaml

OCI registry:

helm install velero oci://ghcr.io/helmforgedev/helm/velero -n velero --create-namespace -f values.yaml

Deployment Examples

# values.yaml — Velero backing up Kubernetes resources only (no PVC data)
# This is the default behavior. PVC contents are NOT included.
credentials:
  existingSecret: velero-s3-credentials # must contain 'cloud' key with AWS-format credentials

configuration:
  defaultBackupTTL: 720h # 30 days
  backupStorageLocations:
    - name: default
      provider: aws
      bucket: my-velero-backups
      default: true
      config:
        region: minio
        s3Url: http://minio.minio.svc.cluster.local:9000
        s3ForcePathStyle: true
        insecureSkipTLSVerify: true

# values.yaml — Full cluster backup including PVC data via node-agent
# Requires node-agent DaemonSet and uses Kopia for filesystem-level backup.
credentials:
  existingSecret: velero-s3-credentials

configuration:
  defaultBackupTTL: 720h
  defaultVolumesToFsBackup: true # include PVC data in all backups by default
  uploaderType: kopia
  backupStorageLocations:
    - name: default
      provider: aws
      bucket: my-velero-backups
      default: true
      config:
        region: minio
        s3Url: http://minio.minio.svc.cluster.local:9000
        s3ForcePathStyle: true
        insecureSkipTLSVerify: true

nodeAgent:
  enabled: true
  resources:
    requests:
      memory: 128Mi
      cpu: 100m
    limits:
      memory: 512Mi
      cpu: 500m

# values.yaml — Scheduled daily and weekly backups with different TTLs
credentials:
  existingSecret: velero-s3-credentials

configuration:
  defaultBackupTTL: 168h # 7 days default
  backupStorageLocations:
    - name: default
      provider: aws
      bucket: my-velero-backups
      default: true
      config:
        region: us-east-1
        # s3Url not needed for real AWS S3

nodeAgent:
  enabled: true

schedules:
  - name: daily
    schedule: '0 3 * * *'
    template:
      ttl: 168h # 7 days
      includedNamespaces:
        - default
        - apps
      defaultVolumesToFsBackup: true
      snapshotVolumes: false

  - name: weekly
    schedule: '0 2 * * 0'
    template:
      ttl: 720h # 30 days
      includedNamespaces: [] # empty = all namespaces
      defaultVolumesToFsBackup: true

# values.yaml — DR environment: Velero locked to restore-only mode
# Use this on a secondary cluster that only receives restores, never creates backups.
credentials:
  existingSecret: velero-s3-credentials

configuration:
  restoreOnlyMode: true
  backupStorageLocations:
    - name: default
      provider: aws
      bucket: my-velero-backups
      default: true
      accessMode: ReadOnly # read-only on DR side
      config:
        region: minio
        s3Url: http://minio.minio.svc.cluster.local:9000
        s3ForcePathStyle: true
        insecureSkipTLSVerify: true

S3 Credentials Format

Velero uses an AWS credentials file format regardless of the S3 provider (including MinIO). The credentials.secretContents field contains the full file content:

[default]
aws_access_key_id=your-access-key
aws_secret_access_key=your-secret-key

For production, store credentials in a pre-created Kubernetes Secret and reference it with credentials.existingSecret:

kubectl create secret generic velero-s3-credentials \
  --from-literal=cloud='[default]
aws_access_key_id=your-access-key
aws_secret_access_key=your-secret-key' \
  -n velero

For backup storage that requires cloud credentials, set credentials.useSecret=true and provide one of credentials.existingSecret, credentials.name, or credentials.secretContents so the Velero pods mount /credentials.

Dual-stack Networking

The metrics Service supports Kubernetes dual-stack fields through service.ipFamilyPolicy and service.ipFamilies. Defaults omit both fields so the cluster default remains authoritative.

service:
  ipFamilyPolicy: PreferDualStack

Use PreferDualStack without service.ipFamilies when the same values file may run on both single-stack and dual-stack clusters. Set service.ipFamilies only when the target cluster advertises the requested families.

Configuration Reference

Core

Image

Plugins

Credentials

RBAC

Configuration

Backup Storage Locations

The default entry uses the AWS plugin in S3-compatible mode. For real AWS S3, omit s3Url.

Schedules

Schedules are rendered as Velero Schedule CRDs. The template.ttl in each schedule overrides the server-level defaultBackupTTL.

Node Agent (Filesystem Backup)

Metrics

Service Networking

Resources and Security

Service Account

Scheduling

Extra

More Information

• Velero Official Website
• Velero Documentation
• Velero GitHub Repository
• HelmForge Velero Chart Source